Browse CVEs

MEDIUM 5.3 CVE-2026-15144 @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can… Fastify\/rate Limit 11.2.0+ Fix from $1,6002026-07-29 MEDIUM 5.3 CVE-2026-18174 @fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma se… Fastify\/forwarded 3.0.2+ Fix from $1,6002026-07-29 MEDIUM 5.3 CVE-2026-7120 @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolu… Fastify Static 10.1.2+ Fix from $1,6002026-07-23 HIGH 7.5 CVE-2026-15074 @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This … Fastify Static 10.1.1+ Fix from $1,9502026-07-23 CRITICAL 10.0 CVE-2026-16117 Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's … Fastify\/http Proxy 11.6.0+ Fix from $2,3002026-07-18 CRITICAL 10.0 CVE-2026-16158 Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and … Fastify\/reply From 12.6.4+ Fix from $2,3002026-07-18 CRITICAL 10.0 CVE-2026-15631 Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the confi… Fastify\/http Proxy 11.6.0+ Fix from $2,3002026-07-18 CRITICAL 9.1 CVE-2026-14198 @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastif… Fastify\/middie 9.3.3+ Fix from $2,3002026-07-01 HIGH 7.5 CVE-2026-14181 @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths conta… Fastify\/middie 9.3.3+ Fix from $1,9502026-07-01 CRITICAL 9.1 CVE-2026-6556 @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string … Fastify\/express 4.0.7+ Fix from $2,3002026-06-30 HIGH 7.5 CVE-2026-7768 @fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote … Fastify\/accepts Serializer 6.0.4+ Fix from $1,9502026-05-04 CRITICAL 9.1 CVE-2026-33804 @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. … Fastify\/middie 9.3.2+ Fix from $2,3002026-04-16 MEDIUM 5.3 CVE-2026-6410 @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function … Fastify Static 9.1.1+ Fix from $1,6002026-04-16 CRITICAL 9.1 CVE-2026-6270 @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application… Fastify\/middie 9.3.2+ Fix from $2,3002026-04-16 MEDIUM 5.9 CVE-2026-6414 @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats… Fastify Static 9.1.1+ Fix from $1,6002026-04-16 HIGH 8.6 CVE-2026-33805 @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added … Fastify\/http Proxy 11.4.4 / 12.6.2+ Fix from $1,9502026-04-15 CRITICAL 9.1 CVE-2026-33807 @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited… Fastify\/express 4.0.5+ Fix from $2,3002026-04-15 CRITICAL 9.1 CVE-2026-33808 Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options… Fastify\/express 4.0.5+ Fix from $2,3002026-04-15 HIGH 7.5 CVE-2026-33806 Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a sp… Fastify 5.8.5+ Fix from $1,9502026-04-15 MEDIUM 6.1 CVE-2026-3635 Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a… Fastify 5.8.3+ Fix from $1,6002026-03-23 MEDIUM 5.3 CVE-2026-3419 Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(… Fastify 5.8.1+ Fix from $1,6002026-03-06 CRITICAL 9.1 CVE-2026-2880 A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example,… Fastify\/middie 9.2.0+ Fix from $2,3002026-02-27 HIGH 7.5 CVE-2026-25223 Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where requ… Fastify 5.7.2+ Fix from $1,9502026-02-03 HIGH 8.8 CVE-2026-22031 @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to versio… Fastify\/middie 9.1.0+ Fix from $1,9502026-01-19 MEDIUM 5.4 CVE-2025-66415 fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attack… Reply From after 12.4.0 Fix from $1,6002025-12-01 HIGH 7.5 CVE-2025-32442 Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify differ… Fastify 5.3.2+ Fix from $1,9502025-04-18 HIGH 7.5 CVE-2023-51701 fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from`… Reply From 9.6.0+ Fix from $1,9502024-01-08 HIGH 8.8 CVE-2023-31999 All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purp… Oauth2 7.2.0+ Fix from $1,9502023-07-04 HIGH 8.1 CVE-2023-29019 @fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions… Passport 1.1.0 / 2.3.0+ Fix from $1,9502023-04-21 MEDIUM 6.5 CVE-2023-29020 @fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by… Passport 1.1.0 / 2.3.0+ Fix from $1,6002023-04-21